RCE in Genetech Solutions WordPress Pie Register Plugin
CVE-2025-34077
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
EPSS exploit prediction
EPSS: 0.151 (96.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.143 · newest: 0.151 · change: +0.008
Affected products
- Genetech Solutions WordPress Pie Register Plugin — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp… (exploit)
- www.exploit-db.com/exploits/50395 (exploit)
- pieregister.com/ (product)
- github.com/GTSolutions/Pie-Register (product)
- wordpress.org/plugins/pie-register/ (product)
- vulncheck.com/advisories/wordpress-pie-register-plugin-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34077?
- CVE-2025-34077 is a vulnerability in Genetech Solutions WordPress Pie Register Plugin, classified under Code Injection. Published 2025-07-09.
- Is CVE-2025-34077 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.